Releases watchmaker version 0.30.0 #369
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run terrafirm integration tests | |
| on: | |
| # Run on demand | |
| workflow_dispatch: | |
| inputs: | |
| artifact-run-id: | |
| description: Workflow run ID from build.yml that contains build artifacts | |
| required: false | |
| type: string | |
| # Run on pull request review with a specific command | |
| pull_request_review: | |
| types: [submitted] | |
| permissions: | |
| actions: read | |
| contents: read | |
| jobs: | |
| trigger: | |
| runs-on: ubuntu-latest | |
| if: contains(github.event.review.body, '/build') || github.event_name == 'workflow_dispatch' | |
| outputs: | |
| run-id: ${{ steps.trigger.outputs.run-id }} | |
| artifact-run-id: ${{ steps.artifact-run.outputs.artifact-run-id }} | |
| steps: | |
| - name: Set terrafirm run-id | |
| id: trigger | |
| run: | | |
| RUN_ID=$(uuidgen) | |
| echo "run-id=${RUN_ID}" >> "$GITHUB_OUTPUT" | |
| echo "RUN_ID=${RUN_ID}" | |
| - name: Resolve artifact run-id | |
| id: artifact-run | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| INPUT_ARTIFACT_RUN_ID: ${{ github.event.inputs.artifact-run-id || '' }} | |
| REVIEW_BODY: ${{ github.event.review.body || '' }} | |
| TARGET_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: | | |
| set -euo pipefail | |
| poll_run_until_complete() { | |
| local run_id="$1" | |
| local wait_seconds=0 | |
| local max_wait_seconds=3600 | |
| local poll_interval=10 | |
| local run_status | |
| local run_conclusion | |
| while true; do | |
| run_status="$(gh api "/repos/${{ github.repository }}/actions/runs/$run_id" --jq '.status')" | |
| run_conclusion="$(gh api "/repos/${{ github.repository }}/actions/runs/$run_id" --jq '.conclusion')" | |
| if [[ "$run_status" == "completed" ]]; then | |
| if [[ "$run_conclusion" != "success" ]]; then | |
| echo "Run $run_id completed without success (conclusion=$run_conclusion)" | |
| exit 1 | |
| fi | |
| return 0 | |
| fi | |
| if (( wait_seconds >= max_wait_seconds )); then | |
| echo "Timed out waiting for build run $run_id to complete" | |
| exit 1 | |
| fi | |
| echo "Build run $run_id is still $run_status. Waiting ${poll_interval}s..." | |
| sleep "$poll_interval" | |
| wait_seconds=$((wait_seconds + poll_interval)) | |
| done | |
| } | |
| COMMENT_ARTIFACT_RUN_ID="" | |
| if [[ "$REVIEW_BODY" =~ /build[[:space:]]+([0-9]+) ]]; then | |
| COMMENT_ARTIFACT_RUN_ID="${BASH_REMATCH[1]}" | |
| fi | |
| if [[ -n "$INPUT_ARTIFACT_RUN_ID" ]]; then | |
| ARTIFACT_RUN_ID="$INPUT_ARTIFACT_RUN_ID" | |
| elif [[ -n "$COMMENT_ARTIFACT_RUN_ID" ]]; then | |
| ARTIFACT_RUN_ID="$COMMENT_ARTIFACT_RUN_ID" | |
| else | |
| ACTIVE_ARTIFACT_RUN_ID="$({ | |
| gh api \ | |
| "/repos/${{ github.repository }}/actions/workflows/build.yml/runs?head_sha=$TARGET_SHA&per_page=30" \ | |
| --jq '.workflow_runs[] | select(.status != "completed") | .id' | |
| } | head -n1)" | |
| if [[ -n "$ACTIVE_ARTIFACT_RUN_ID" ]]; then | |
| ARTIFACT_RUN_ID="$ACTIVE_ARTIFACT_RUN_ID" | |
| poll_run_until_complete "$ARTIFACT_RUN_ID" | |
| else | |
| ARTIFACT_RUN_ID="$({ | |
| gh api \ | |
| "/repos/${{ github.repository }}/actions/workflows/build.yml/runs?head_sha=$TARGET_SHA&status=completed&per_page=30" \ | |
| --jq '.workflow_runs[] | select(.conclusion == "success") | .id' | |
| } | head -n1)" | |
| fi | |
| fi | |
| if [[ -z "$ARTIFACT_RUN_ID" ]]; then | |
| echo "No successful build.yml run found for sha: $TARGET_SHA" | |
| exit 1 | |
| fi | |
| RUN_WORKFLOW_PATH="$(gh api "/repos/${{ github.repository }}/actions/runs/$ARTIFACT_RUN_ID" --jq '.path')" | |
| RUN_CONCLUSION="$(gh api "/repos/${{ github.repository }}/actions/runs/$ARTIFACT_RUN_ID" --jq '.conclusion')" | |
| RUN_HEAD_SHA="$(gh api "/repos/${{ github.repository }}/actions/runs/$ARTIFACT_RUN_ID" --jq '.head_sha')" | |
| if [[ "$RUN_WORKFLOW_PATH" != ".github/workflows/build.yml" ]]; then | |
| echo "Run $ARTIFACT_RUN_ID is not a build.yml run (path=$RUN_WORKFLOW_PATH)" | |
| exit 1 | |
| fi | |
| if [[ "$RUN_CONCLUSION" != "success" ]]; then | |
| echo "Run $ARTIFACT_RUN_ID is not successful (conclusion=$RUN_CONCLUSION)" | |
| exit 1 | |
| fi | |
| if [[ "$RUN_HEAD_SHA" != "$TARGET_SHA" ]]; then | |
| echo "Run $ARTIFACT_RUN_ID head_sha ($RUN_HEAD_SHA) does not match target sha ($TARGET_SHA)" | |
| exit 1 | |
| fi | |
| echo "artifact-run-id=$ARTIFACT_RUN_ID" >> "$GITHUB_OUTPUT" | |
| echo "ARTIFACT_RUN_ID=$ARTIFACT_RUN_ID" | |
| test-source: | |
| runs-on: | |
| - codebuild-p3-terrafirm-${{ github.run_id }}-${{ github.run_attempt }} | |
| instance-size:small | |
| needs: trigger | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| source-build: [rhel8, rhel9, win16, win19, win22] | |
| env: | |
| AWS_DEFAULT_REGION: us-east-1 | |
| TF_VAR_aws_region: us-east-1 | |
| TF_VAR_codebuild_id: ${{ needs.trigger.outputs.run-id }} | |
| TF_VAR_common_args: "-n -e dev" | |
| TF_VAR_github_artifact_repo_name: ${{ github.event.repository.name }} | |
| TF_VAR_github_artifact_repo_owner: ${{ github.repository_owner }} | |
| TF_VAR_github_artifact_run_id: ${{ needs.trigger.outputs.artifact-run-id }} | |
| TF_VAR_github_artifact_token_ssm_parameter: /watchmaker/integration/github-artifact-token/${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.source-build }} | |
| TF_VAR_git_ref: ${{ github.ref || github.sha }} | |
| TF_VAR_git_repo: "${{ github.server_url }}/${{ github.repository }}.git" | |
| TF_VAR_source_builds: '["${{ matrix.source-build }}"]' | |
| TF_VAR_source_source: github_actions_artifact | |
| TF_VAR_standalone_builds: '[]' | |
| steps: | |
| - name: Store GitHub artifact token in SSM | |
| run: | | |
| for attempt in 1 2 3 4 5; do | |
| if output=$(aws ssm put-parameter \ | |
| --name "$TF_VAR_github_artifact_token_ssm_parameter" \ | |
| --type SecureString \ | |
| --value "${{ github.token }}" \ | |
| --overwrite 2>&1); then | |
| exit 0 | |
| fi | |
| echo "$output" >&2 | |
| if [[ "$output" != *"TooManyUpdates"* ]]; then | |
| exit 1 | |
| fi | |
| if [[ "$attempt" == "5" ]]; then | |
| echo "Failed to store GitHub artifact token in SSM after $attempt attempts" | |
| exit 1 | |
| fi | |
| sleep_seconds=$((attempt * 5)) | |
| echo "Retrying SSM put-parameter after ${sleep_seconds}s (attempt ${attempt}/5)" | |
| sleep "$sleep_seconds" | |
| done | |
| - name: Terrafirm integration tests | |
| id: terrafirm | |
| uses: plus3it/terrafirm/.github/actions/test@1091935a976104e701d20905ab63da4a8e6d5b8f | |
| with: | |
| destroy-after-test: true | |
| # terrafirm-repository: lorengordon/terrafirm | |
| # terrafirm-ref: feat/source-dist-artifact | |
| - name: Delete GitHub artifact token from SSM | |
| if: always() | |
| run: | | |
| if aws ssm get-parameter --name "$TF_VAR_github_artifact_token_ssm_parameter" >/dev/null 2>&1; then | |
| for attempt in 1 2 3 4 5; do | |
| if output=$(aws ssm delete-parameter --name "$TF_VAR_github_artifact_token_ssm_parameter" 2>&1); then | |
| exit 0 | |
| fi | |
| echo "$output" >&2 | |
| if [[ "$output" != *"TooManyUpdates"* ]]; then | |
| exit 1 | |
| fi | |
| if [[ "$attempt" == "5" ]]; then | |
| echo "Failed to delete GitHub artifact token from SSM after $attempt attempts" | |
| exit 1 | |
| fi | |
| sleep_seconds=$((attempt * 5)) | |
| echo "Retrying SSM delete-parameter after ${sleep_seconds}s (attempt ${attempt}/5)" | |
| sleep "$sleep_seconds" | |
| done | |
| else | |
| echo "SSM parameter not found, skipping delete: $TF_VAR_github_artifact_token_ssm_parameter" | |
| fi | |
| test-standalone: | |
| runs-on: | |
| - codebuild-p3-terrafirm-${{ github.run_id }}-${{ github.run_attempt }} | |
| instance-size:small | |
| needs: trigger | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| standalone-build: [rhel8, rhel9, win16, win19, win22] | |
| env: | |
| AWS_DEFAULT_REGION: us-east-1 | |
| TF_VAR_aws_region: us-east-1 | |
| TF_VAR_codebuild_id: ${{ needs.trigger.outputs.run-id }} | |
| TF_VAR_common_args: "-n -e dev" | |
| TF_VAR_github_artifact_repo_name: ${{ github.event.repository.name }} | |
| TF_VAR_github_artifact_repo_owner: ${{ github.repository_owner }} | |
| TF_VAR_github_artifact_run_id: ${{ needs.trigger.outputs.artifact-run-id }} | |
| TF_VAR_github_artifact_token_ssm_parameter: /watchmaker/integration/github-artifact-token/${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.standalone-build }} | |
| TF_VAR_git_ref: ${{ github.ref || github.sha }} | |
| TF_VAR_git_repo: "${{ github.server_url }}/${{ github.repository }}.git" | |
| TF_VAR_source_builds: '[]' | |
| TF_VAR_standalone_builds: '["${{ matrix.standalone-build }}"]' | |
| TF_VAR_standalone_source: github_actions_artifact | |
| steps: | |
| - name: Store GitHub artifact token in SSM | |
| run: | | |
| for attempt in 1 2 3 4 5; do | |
| if output=$(aws ssm put-parameter \ | |
| --name "$TF_VAR_github_artifact_token_ssm_parameter" \ | |
| --type SecureString \ | |
| --value "${{ github.token }}" \ | |
| --overwrite 2>&1); then | |
| exit 0 | |
| fi | |
| echo "$output" >&2 | |
| if [[ "$output" != *"TooManyUpdates"* ]]; then | |
| exit 1 | |
| fi | |
| if [[ "$attempt" == "5" ]]; then | |
| echo "Failed to store GitHub artifact token in SSM after $attempt attempts" | |
| exit 1 | |
| fi | |
| sleep_seconds=$((attempt * 5)) | |
| echo "Retrying SSM put-parameter after ${sleep_seconds}s (attempt ${attempt}/5)" | |
| sleep "$sleep_seconds" | |
| done | |
| - name: Terrafirm integration tests | |
| id: terrafirm | |
| uses: plus3it/terrafirm/.github/actions/test@1091935a976104e701d20905ab63da4a8e6d5b8f | |
| with: | |
| destroy-after-test: true | |
| # terrafirm-repository: lorengordon/terrafirm | |
| # terrafirm-ref: feat/source-dist-artifact | |
| - name: Delete GitHub artifact token from SSM | |
| if: always() | |
| run: | | |
| if aws ssm get-parameter --name "$TF_VAR_github_artifact_token_ssm_parameter" >/dev/null 2>&1; then | |
| for attempt in 1 2 3 4 5; do | |
| if output=$(aws ssm delete-parameter --name "$TF_VAR_github_artifact_token_ssm_parameter" 2>&1); then | |
| exit 0 | |
| fi | |
| echo "$output" >&2 | |
| if [[ "$output" != *"TooManyUpdates"* ]]; then | |
| exit 1 | |
| fi | |
| if [[ "$attempt" == "5" ]]; then | |
| echo "Failed to delete GitHub artifact token from SSM after $attempt attempts" | |
| exit 1 | |
| fi | |
| sleep_seconds=$((attempt * 5)) | |
| echo "Retrying SSM delete-parameter after ${sleep_seconds}s (attempt ${attempt}/5)" | |
| sleep "$sleep_seconds" | |
| done | |
| else | |
| echo "SSM parameter not found, skipping delete: $TF_VAR_github_artifact_token_ssm_parameter" | |
| fi |